Overview

overview

6

Static

static

1

5c2b41621f...ad.exe

windows7-x64

6

5c2b41621f...ad.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    26s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05-04-2023 13:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c2b41621fb9e7bc1bbfe8b0b8a49794d8a0f15b6fd8bed67a8497bf2eb47ead.exe

  • Size

    16.8MB

  • MD5

    9563188dded3de6264fceb4d210116c8

  • SHA1

    6b83993de84b3afe789c4b9ba31fd84d4dbae956

  • SHA256

    5c2b41621fb9e7bc1bbfe8b0b8a49794d8a0f15b6fd8bed67a8497bf2eb47ead

  • SHA512

    f557bafc0f0fa2d23509d00a7e76d44c07ec66a6e2a63bccfaf8d6e71c7a4bfaaa42f1cc27858fe499fd740314efdd79eed0642a932e30ef36c33efe233cc8fa

  • SSDEEP

    393216:/5PFiP0FQRjLlpeF+JF4MR7J4QhLSqP0n:RIdlpe0jJbSqPU

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c2b41621fb9e7bc1bbfe8b0b8a49794d8a0f15b6fd8bed67a8497bf2eb47ead.exe
    "C:\Users\Admin\AppData\Local\Temp\5c2b41621fb9e7bc1bbfe8b0b8a49794d8a0f15b6fd8bed67a8497bf2eb47ead.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetWindowsHookEx
    PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2008-54-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-56-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-55-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-57-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-59-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-58-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-60-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-62-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-61-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-64-0x0000000002970000-0x0000000002AB0000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/2008-65-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2008-67-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-66-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-69-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-68-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-71-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-70-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-72-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-74-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-73-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-76-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-77-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-78-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-79-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-80-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-81-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-75-0x0000000000400000-0x0000000000ED8000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/2008-82-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-83-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-84-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-86-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-85-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-87-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-88-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-89-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-90-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-91-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-93-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-92-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-94-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-95-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-97-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-96-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-98-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-99-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-100-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-101-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-103-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-102-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-104-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-105-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-106-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-107-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-108-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-109-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-111-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-110-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-113-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-112-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-114-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-115-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-116-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-117-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-118-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-497-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2008-498-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2008-499-0x00000000003A0000-0x00000000003A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2008-503-0x0000000004DB0000-0x0000000004F3F000-memory.dmp
    Filesize

    1.6MB

    Download